I agree. Some lower level library could be rigged to return an Authorized<UserId> when that user is in fact not authorized. So we would have to make sure that

I agree. Some lower level library could be rigged to return an Authorized<UserId> when that user is in fact not authorized. So we would have to make sure that type safety is ultimately backed by a hardware based encryption module, but that's just not where we are today.